Academics at Germany’s Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone’s location or run new features when the device is turned off.
The research is the first—or at least among the first—to study the risk posed by chips running in low-power mode.Not to be confused with iOS's low-power mode for conserving battery life, the low-power mode (LPM) in this research allows chips responsible for near-field communication, ultra wideband, and Bluetooth to run in a special mode that can remain on for 24 hours after a device is turned off.
Besides allowing malware to run while the iPhone is turned off, exploits targeting LPM could also allow malware to operate with much more stealth since LPM allows firmware to conserve battery power.Ultimately, Find My and other features enabled by LPM help provide added security because they allow users to locate lost or stolen devices and lock or unlock car doors even when batteries are depleted.“Hardware and software attacks similar to the ones described, have been proven practical in a real-world setting, so the topics covered in this paper are timely and practical,” John Loucaides, senior vice president of strategy at firmware security firm Eclypsium.